CUPS PlenaryJoint PWG / Open Printing Summit - May 2021

Michael R Sweet (Lakeside Robotics)

Before We Begin...● PWG Antitrust Policy:

● https://www.pwg.org/chair/membership_docs/pwg-antitrust-policy.pdf ● The IEEE-ISTO Printer Working Group ("PWG") will not become involved in the

business decisions of its Members. The PWG strictly complies with applicable antitrust laws. Every PWG meeting attendee shall comply with this policy. The PWG Officers and PWG Workgroup Officers are responsible to ensure that this policy is adhered to in all PWG activities.

● PWG Intellectual Property Policy: ● https://www.pwg.org/chair/membership_docs/pwg-ip-policy.pdf ● TL;DR: Anything you say in a PWG meeting or email to a PWG address can be

used in a PWG standard ● (but please do read the IP policy above if you haven't done so)

2

Topics● Introduction

● Apple, Open Printing, and CUPS ● CUPS 2.4 ● Deprecations ● Future Stuff ● Q&A ● Resources

3

Introduction● CUPS is the standards-based, open source printing system developed by

OpenPrinting for Linux® and other Unix®-like operating systems. CUPS uses IPP Everywhere™ to support printing to local and network printers

● CUPS is provided under the Apache License v2.0 with an exception that allows linking to GPL2-only software (like Gutenprint)

● The CUPS web site, source code, and bug database are hosted on Github ○ https://openprinting.github.io/cups ○ https://github.com/openprinting/cups/

● But wait, I thought that Apple was developing CUPS?!?

4

Apple, OpenPrinting, and CUPS - 1/2● Apple hasn't been actively developing CUPS since I left in December 2019

● Two security fixes and an update to the USB backend to support Apple Silicon-based Macs have gone into CUPS 2.3.3 and 2.3.4

● OpenPrinting decided to fork Apple CUPS in September 2020 ● Initial goal was to merge all the common Linux/BSD patches ● Have a development team consisting of core CUPS packagers with many

volunteers ● OpenPrinting has released two updates to Apple CUPS 2.3.3:

● November 27, 2020: OpenPrinting CUPS 2.3.3op1 (bug fix update) ● February 1, 2021: OpenPrinting CUPS 2.3.3op2 (security update)

● OpenPrinting is now working towards a CUPS 2.4.0 feature release

5

Apple, OpenPrinting, and CUPS - 2/2● I've been contracted by Apple to apply important OpenPrinting CUPS bug

fixes to Apple CUPS on macOS, which will continue to use CUPS 2.3.x ● This work is ongoing and will yield an Apple CUPS 2.3.5 release in June

2021 ● While Apple would like to continue sharing bug fixes going forward, they are

not interested in further development of CUPS features for macOS

6

CUPS 2.4

7

CUPS 2.4 - Next Feature Release● Add AirPrint/Mopria compatibility (done)

● Shared printers now report all required attributes/keys/values ● Ready media returns a list of supported values configured for the system

● Add OAuth 2.0/OpenID authentication (to-do) ● Used for Microsoft Universal Print Service, among other things

● Add pkg-config support (done) ● Provides cups-config functionality through pkg-config

● Add snapcraft support (mostly done) ● "job-sheets-col" and better "media-col" attribute support (to-do) ● TLS and X.509 improvements (to-do) ● New deprecations: cups-config and Kerberos authentication (done)

8

CUPS 2.4 - OAuth 2.0/OpenID● Replacement for Kerberos SSO

● Doesn't require root access or user changing gymnastics like Kerberos ● Many open source solutions available, including my own:

● https://www.msweet.org/moauth ● SAML and Webauthn authentication backends are commonly available, too ● Support OpenID/RFC 8414 compliant OAuth 2.0 authorization servers

○ Authorization server is reported via IPP "oauth-authorization-server-uri (uri)" attribute

● Bearer and refresh tokens will be cached per-user/auth-server ● Authorization UI will be presented using embedded web view - only available when

printing from system console ○ Command-line tool for registering bearer token, too

9

Deprecations

10

Deprecations● We periodically deprecate functionality that either is no longer necessary or

will prevent us from improving CUPS ● When we deprecate something:

○ We announce the deprecation as far in advance as possible ○ We display a warning that the functionality is going away in a future

release of CUPS ○ We help developers and users migrate to any replacement functionality,

if applicable ● Deprecation is a necessary step prior to removal from CUPS ● Deprecated items are still functional until removed

11

Deprecations● After a transition period, deprecated items are removed from CUPS

○ Deprecated CUPS APIs are never fully removed from shared libraries (non-functional stubs remain) to preserve binary compatibility

● We've had some hard exceptions over the years: ○ Security issues forced us to do a hard transition of some cupsd.conf

directives to cups-files.conf ○ Security issues forced us to drop interface script support ○ Performance and architectural issues forced us to drop CUPS browsing

before Avahi was fully supported/deployed

12

Deprecations - Raw Queues● Raw queues will continue to work in CUPS 2.4.x ● Why deprecate them?

○ Raw queues pointing to shared printers cause problems for sandboxed applications on macOS and applications using AppArmor/SELinux on Linux (no direct network access)

○ Raw queues pointing to label printers, etc. require applications to provide printer-specific UI and print data, the opposite of what CUPS is about

○ Raw queues do not work with file: device queues, which people still occasionally use with special-purpose printers and software

13

Deprecations - Printer Drivers● Printer drivers and the PPD APIs will continue to work in CUPS 2.4.x ● PPD files were deprecated in CUPS 1.4 (12 years ago) but we didn't have a

replacement strategy for printer drivers at that time ● IPP Everywhere (and related standards) provide the replacement for most

printer drivers ○ Strategy for other printers and drivers is to use Printer Applications

● Printer driver support will be removed in CUPS 3.0

14

Deprecations - Printer Drivers● Why deprecate printer drivers?

○ At least 98% of all printers sold since 2010 support IPP, Apple/PWG Raster, and JPEG; many (about half) support PDF ■ Holdouts are industrial label printers and certain vertical market

printers ○ PPDs and drivers have been holding us back from offering a better user

experience (ready media, localization, full range of printer options/values), improved document processing, and improved accounting

○ PPDs and drivers are a security and distribution nightmare

15

Deprecations - cups-config● cups-config will continue to be provided in CUPS 2.4.x ● This script was provided before pkg-config existed ● Many developers have asked for pkg-config support

● pkg-config also handles dependencies for us ● cups-config will be removed in CUPS 3.0

16

Deprecations - Kerberos● Kerberos will continue to work in CUPS 2.4.x ● Kerberos is a legacy Single Sign On (SSO) technology that doesn't scale

well, depends on an experimental HTTP authentication method, and requires a lot of special-casing to work

● Primarily used with Microsoft ActiveDirectory, which has moved to OAuth 2.0 ● OAuth 2.0 support is coming in CUPS 2.4 ● Kerberos support will be removed in CUPS 3.0

17

Future Stuff

18

Transition of Printing

19

User Applications

CUPS

PPD Files

Printer Drivers

IPP Everywhere™ PostScript Raster

User Applications

CUPS

PostScript Printer App

Printer Application

IPP Everywhere™ PostScript Raster

CUPS 3.0 - Modular Printing Architecture● Commands: lp, lpr, lpstat, cancel, etc. ● Local Server

● Handles local print requests for desktop/mobile devices ● Only temporary IPP Everywhere print queues ● Runs as user ● UNIX domain socket and/or D-Bus API and/or XPC API

● Sharing Server ● Handles network print requests and local printing on headless servers ● Full print accounting/ACLs/pre-processing of documents ● OAuth 2 and PAM-based authentication ● IPP Shared Infrastructure Extensions/System support

● Library: libcups, as exists today

20

CUPS 3.0 - Overview

21

User Applications

CUPS Commands

CUPS Local Server

Printer Applications

CUPS Sharing Server

User-Level System-Level

CUPS Library

CUPS 3.0 - Local Server● Handles all discovery and

communications with printers ● Handles authentication, authorization,

consent, and notification UI ● Converts to/from PDF/raster as needed

for printers ● Job history is limited to the current

session/login ● No web interface ● Configuration limited to listing specific

printers or servers that cannot be discovered via DNS-SD ("profiles")

22

D-Bus Library

CUPS Library Graphics Libraries

DNS-SD Library

CUPS Local Server

Socket APIPrinter(s)Printer(s)Printer(s)

Job(s)Job(s)Job(s)

System

D-Bus API

XPC API

UI Services

CUPS 3.0 - Sharing Server● Handles all communications with

printers ● Authorization/consent/notification UI

needs to be handled by client ● Converts to/from PDF/raster as

needed for printers ● Job history is configurable ● Web interface ● Configuration similar to existing cupsd ● OAuth token introspection (RFC

7662) and scopes for ACLs

23

D-Bus Library

CUPS Library Graphics Libraries

DNS-SD Library

CUPS Sharing Server

Socket APIPrinter(s)Printer(s)Printer(s)

Job(s)Job(s)Job(s)

System

Auth

Accounting

Web IF

CUPS 3.0 - Challenges● Much broader scope and integration than the original CUPS work ● Desktop support - need to uplift GNOME/KDE/XFCE desktops to new D-Bus

API for printing, authorization, consent UI ● Need developers to work on the local and sharing servers, desktop UI/

services ● Can probably use/adapt PAPPL code for the core server bits ● Much of the print dialog work can be repurposed ● Probably have existing authorization/notification UI we can use

● Graphics libraries - current PDF tools/libraries have problematic licenses or other limitations

24

Q&A

25

Questions?

Resources● CUPS Web Site

○ https://openprinting.github.io/cups ● CUPS Repository

○ https://github.com/OpenPrinting/cups ● CUPS Programming Manual

○ https://openprinting.github.io/cups/doc/cupspm.html ○ https://openprinting.github.io/cups/doc/cupspm.epub

26